Security and confidentiality
70. According to the Biobank, data and samples will be coded
to protect the confidentiality of the individual participants.[124]
It says that scientists using the data for research will not be
able to identify individuals but that the data cannot be fully
anonymous because the study organisers will have to be able to
add information on participants' health to the individual records
at a later date. The Consumers' Association raises three questions
about risks of releasing identifiable data:[125]
- Who will have control of the storage and access of files?
- What security measures will be in place?
- Who will hold the key to the reversing of anonymised data
and will they be independent of the owners and users?
The HGC argues for "careful arrangements for vetting staff
and for ensuring that maintenance of confidentiality should be
a condition of employment. Any material breach of this should
result in dismissal".[126]
The MRC told us that "Only a very few individuals employed
within the coordinating centre will have access to the identifying
data, in order to allow followup information on health from
NHS records to be added to the correct records. Security will
be a key issue in preparing the detailed specification for the
computer systems. Prior to accessing any data, users will be required
to sign a licence agreement including provisions to ensure confidentiality
is protected".[127]
Nevertheless, the HGC rightly recognises that there is a risk
that the identifiable data could be made public: "Ultimately
there will remain a remote possibility that identifiable information
will be released from the UK Biobank and that this must be clearly
explained when seeking consent. The safeguards to ensure confidentiality
will need to be clearly spelt out, along with the possible nature
and type of breaches of confidentiality".[128]
71. The HGC cites the views of Dr Ross Anderson that "encryption
could become a technical 'comfort blanket' that led to complacency
about other aspects of data integrity". Dr Anderson told
the HGC that "inference control", a technique that limits
the ability to deduce the identity of an individual, could prevent
information being obtained by a series of overlapping data queries.[129]
The Human Genetics Commission has recommended that the Government
fund research into encryption techniques to ensure data security.
We support this view.
72. The HGC is concerned by comments made by the Information Commissioner
about the exclusions in the Data Protection Act which may allow
access to information to some parties, including the police: "We
feel that this is sufficiently important to merit a statement
to Parliament by the Home Secretary or other senior Minister.
This should clearly state that the police would never request
access to the UK Biobank, or failing, that make clear the circumstances
under which police access might be sought for particularly serious
crimes. This information could then be given to individuals when
seeking consent". The Consumers' Association agrees, stating
that "the appropriate legal safeguards should be in place
before Biobank starts recruitment".[130]
The Biobank website concedes that the police could have access
to records, but "only in the unlikely event that the courts
require information by court order". It should be unlikely,
given that a national database of only 500,000 people between
45 and 69 years would be of little use to a police investigation
but we recognise that the pressures faced by the police in high
profile cases may lead to an attempt to use data stored in Biobank.
The arguments for legislation are complex and we will not comment
here except to express dismay that the HGC's views, first aired
in its report Inside Information, published in May 2002,
have yet to receive a response from Government.[131]
Hazel Blears, Parliamentary Under Secretary of State for Public
Health, said, in a written answer to the Chairman on 10 June 2002,
merely that "The Government do not currently intend to introduce
further safeguards for the protection of personal genetic information
before members of the public are asked to donate blood samples
to the UK Biobank".[132]
It is important that participants in Biobank are aware of the
risk that police could obtain access to their data and samples
before giving consent and before their samples are taken. The
funders should monitor to what extent this issue acts as a disincentive
to participation.
Conclusion
73. We are not qualified to comment on the scientific merits of
the UK Biobank. Nevertheless, we are concerned that the peer-review
and funding process that led to its establishment was less than
satisfactory. The MRC is only one of three funders and the Wellcome
Trust has contributed the same amount (£20 million). The
funders together must bear equal responsibility for the lack of
confidence that exists in some quarters in the project and concerns
about its operation.
82
Department of Trade and Industry, Science Budget 2003-04 to
2005-06, December 2002, page 34 Back
83
Minutes of evidence taken before the Science and Technology Committee,
Session 2002-03, HC160-i, Q35 Back
84
Minutes of evidence taken before the Science and Technology Committee,
Session 2002-03, HC160-i, Q34 Back
85
Q 62 Back
86
Ev 67 Back
87
Ev 68 Back
88
www.ukbiobank.ac.uk Back
89
Q 107 Back
90
Including 5% contingency Back
91
Assuming that the £5 million contribution from the Department
of Health is spread evenly over 5 years. Back
92
Ev 68 Back
93
Ev 52 Back
94
Ev 53 Back
95
www.genewatch.org; Ev 27-28 Back
96
Ev 69 Back
97
Q 110 Back
98
Ev 21 Back
99
HC Deb, 10 Jun 2002, col 1091W Back
100
Ev 54 Back
101
Ev 58 Back
102
Q 131 Back
103
Ev 33 Back
104
Ev 33 Back
105
The Wellcome Trust, MRC, Public Perceptions of the Collection
of Human Biological Samples, October 2000 Back
106
The Wellcome Trust, MRC, Biobank A Question of Trust: A Consultation
Exploring and Addressing Questions of Public Trust, February
2002 Back
107
Q 87 Back
108
Ev 58 Back
109
Q 137 Back
110
Ev 52 Back
111
Ev 53 Back
112
Unpublished submission from Jackie Glatter, Consumers' Association Back
113
HC Deb, 3 July 2002, Col 369 Back
114
HC Deb, 3 July 2002, Col 368 Back
115
Ev 54 Back
116
Ev 59 Back
117
Q 144 Back
118
Ev 55 Back
119
Fifth Report of the Science and Technology Committee, Session
2000-01, Genetics and Insurance, HC 174 Back
120
Ev 67 Back
121
Ev 67 Back
122
HC Deb, 3 July 2002, col 371 Back
123
HC Deb, 3 July 2002, col 368 Back
124
www.ukbiobank.ac.uk Back
125
Ev 58 Back
126
Ev 54-55 Back
127
Ev 68 Back
128
Ev 55 Back
129
Ev 54 Back
130
Ev 59 Back
131
Human Genetics Commission, Inside Information Balancing
Interests in the Use of Personal Genetic Data, May 2002 Back
132
HC Deb, 10 Jun 2002, col 1122W Back